CVE-2026-61130 is a vulnerability in Oracle Commerce Platform version 11.4.0, specifically in the Dynamo Application Framework component. It permits unauthenticated attackers with network access via HTTP to compromise the platform, resulting in unauthorized access to all accessible data and the ability to cause a hang or repeated crash, leading to a complete denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and availability impact but no integrity impact. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly state a patch or remediation for this vulnerability, leaving patch status unconfirmed.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Commerce Platform 11.4.0 and cause a complete denial of service by hanging or crashing the platform. This impacts confidentiality and availability severely, with no integrity impact reported.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory and subsequent updates for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to the Oracle Commerce Platform HTTP interface to trusted users only.